https://community.splunk.com/t5/Splunk-Search/Subsearch-with-multiple-field-matching/m-p/138794#M38121 <P>One option can be to use join</P> <PRE><CODE>index=charlesriver sourcetype=CrdApp_Events EVENT=LOGIN | bucket span=1d _time | stats count first(_time) as Date by USER | join Date,USER [search index=charlesriver sourcetype=CrdApp_Users | bucket span=1d _time | stats count first(_time) as Date by USER_NAME | table USER_NAME,Date|rename USER_NAME as USER |eval filter=1] |where NOT filter=1 | fields - filter </CODE></PRE> Tue, 12 Nov 2013 16:32:18 GMT somesoni2 2013-11-12T16:32:18Z https://community.splunk.com/t5/Splunk-Search/Subsearch-with-multiple-field-matching/m-p/138792#M38119 <P>Everyday I bring in events (with a logon id, USER below) and a list of approved users. I want to compare the 2 lists together and show unmatched USER fields, but only for the same date between the event list and the approved users list comes in. Currently I am matching but I seem to be joining across all dates. How do I limit the join to only the same date (and USER)?</P> <PRE><CODE>index=charlesriver sourcetype=CrdApp_Events EVENT=LOGIN | bucket span=1d _time | stats count first(_time) as Date by USER | search NOT [search index=charlesriver sourcetype=CrdApp_Users | bucket span=1d _time | stats count first(_time) as Date by USER_NAME | table USER_NAME|rename USER_NAME as USER] </CODE></PRE> Tue, 12 Nov 2013 15:58:46 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-with-multiple-field-matching/m-p/138792#M38119 andrewkenth 2013-11-12T15:58:46Z https://community.splunk.com/t5/Splunk-Search/Subsearch-with-multiple-field-matching/m-p/138793#M38120 <P>Can you try like this (added Date field in subsearch) </P> <P>index=charlesriver sourcetype=CrdApp_Events EVENT=LOGIN | bucket span=1d _time | stats count first(_time) as Date by USER |search NOT [search index=charlesriver sourcetype=CrdApp_Users | bucket span=1d _time | stats count first(_time) as Date by USER_NAME| table Date,USER_NAME|rename USER_NAME as USER]</P> Mon, 28 Sep 2020 15:15:32 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-with-multiple-field-matching/m-p/138793#M38120 somesoni2 2020-09-28T15:15:32Z https://community.splunk.com/t5/Splunk-Search/Subsearch-with-multiple-field-matching/m-p/138794#M38121 <P>One option can be to use join</P> <PRE><CODE>index=charlesriver sourcetype=CrdApp_Events EVENT=LOGIN | bucket span=1d _time | stats count first(_time) as Date by USER | join Date,USER [search index=charlesriver sourcetype=CrdApp_Users | bucket span=1d _time | stats count first(_time) as Date by USER_NAME | table USER_NAME,Date|rename USER_NAME as USER |eval filter=1] |where NOT filter=1 | fields - filter </CODE></PRE> Tue, 12 Nov 2013 16:32:18 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-with-multiple-field-matching/m-p/138794#M38121 somesoni2 2013-11-12T16:32:18Z